OpenAI’s president is ringing the cybersecurity alarm bell.
Greg Brockman says companies need to act now to secure their systems against AI-powered attackers after the “watershed moment for cybersecurity” that was the OpenAI-Hugging Face hack.
“I’ve spoken with many organizations over the past few weeks, and one theme is clear: they know they need to fundamentally uplevel their cybersecurity practices with unprecedented speed,” the OpenAI president and cofounder wrote in a post on his personal blog published on Monday morning.
Brockman said AI tools will soon be able to find vulnerabilities as OpenAI’s models did when they breached Hugging Face’s systems. At the same time, the OpenAI cofounder wrote, “AI will also make it much easier” to fix those flaws to prevent hacks.
‘Pursue the steps below at turbo speed’
OpenAI disclosed in July that, during internal testing, its AI agents were able to break out of a testing environment and then later compromise Hugging Face, a platform where developers publish, share, and download AI models.
The incident underscores how important preparing against vulnerabilities, Brockman wrote.
Brockman shared a 10-point list of actions companies, or “defenders,” should take as soon as possible to bolster their cybersecurity. “Time is of the essence, and defenders will need to pursue the steps below at turbo speed.”
- Get organizational commitment and buy-in.
- Give your security team an agent.
- Equip that agent with security expertise.
- Run security assessments against your own systems immediately.
- Work through your existing vulnerability backlog.
- Put security review directly into your development process.
- Have the agent help fix what it finds.
- Incrementally automate detection triage.
- Have an AI-assisted forensic investigation capability ready before you need it.
- Experiment, run hack weeks, and iterate rapidly.
“The defender’s window is open now,” Brockman wrote. “Over the coming months, every organization will need to begin significantly automating its security program to stay secure, and the security community must urgently rise to define the tools, practices, and playbooks that will increase the power of defenders faster than that of attackers as AI continues to advance.”
